@usagefleet/cli 1.2.78 → 1.2.80

package/README.md

@@ -63,11 +63,11 @@ shell once. `uninstall` removes both again, and self-update keeps them current.
   is at-least-once — the server dedups on `uuid`.
 - **Your real limit %** — the collector uses the Claude login already on the
   machine (subscription OAuth from `claude`: macOS login Keychain, elsewhere
-  `<config dir>/.credentials.json`; falling back to `ANTHROPIC_API_KEY`), sends a
-  1-token ping to the Messages API, and reads Anthropic's
-  `anthropic-ratelimit-unified-5h/7d-utilization` headers. Credentials never
-  leave the machine — only the percentages do. `usagefleet status` shows which
-  login was found.
+  `<config dir>/.credentials.json`; falling back to `ANTHROPIC_API_KEY`) and
+  reads the same 5h/weekly percentages Claude's own `/usage` screen shows —
+  from the free OAuth usage endpoint for subscriptions, or a 1-token Messages
+  ping for API keys. Credentials never leave the machine — only the percentages
+  do. `usagefleet status` shows which login was found.
 
 Uploaded per record: token counts, model, session id, hostname, working
 directory, git branch. Prompts, responses and file contents are never read.
@@ -101,6 +101,11 @@ on re-install, and skipped entirely with `USAGEFLEET_HOOK=0`):
 }
 ```
 
+If `USAGEFLEET_CONFIG` was set when you logged in, the installed command carries
+it (`USAGEFLEET_CONFIG=<path> usagefleet guard`, or `set "..." && ...` on
+Windows). That is what binds the hook to the right store, and so to the right
+Anthropic account — see "Two Claude accounts on one machine" below.
+
 `guard` **fails open** everywhere else — no config, server down, timeout (5s),
 old server, 429 — because a tracker problem must never stop you working. Only
 whole prompts are blocked, never tool calls mid-turn, so the current turn always
@@ -122,7 +127,7 @@ Env vars override the file:
 | `USAGEFLEET_DESKTOP` | override the Claude Desktop sessions dir; `off` to skip it |
 | `USAGEFLEET_PI` | override the pi sessions dirs, comma-separated; `off` to skip |
 | `USAGEFLEET_INTERVAL` | watch poll seconds (default 15) |
-| `USAGEFLEET_LIMITS_INTERVAL` | seconds between limit pings (default 300, so the 1-token ping isn't every cycle) |
+| `USAGEFLEET_LIMITS_INTERVAL` | seconds between limit reports (default 60; 300 on API keys, where each report costs a 1-token ping) |
 | `USAGEFLEET_NOTIFY` | desktop notifications, on by default |
 | `USAGEFLEET_NOTIFY_THRESHOLDS` | utilization % that trigger an alert (default `80,95`) |
 | `USAGEFLEET_BATCH` | records per upload (default 100, server caps at 1000) |
@@ -149,9 +154,18 @@ CLAUDE_CONFIG_DIR=~/.claude-work \
   usagefleet login uf_...
 ```
 
-Each reports its own account, and the dashboard keeps their limits apart. With a
-relocated config dir the macOS Keychain is skipped on purpose: that item belongs
-to the default login.
+Each reports its own account, and the dashboard keeps their limits apart. The
+prompt guard follows: because `USAGEFLEET_CONFIG` was set for this `login`, the
+hook written into `~/.claude-work/settings.json` carries it, so that account's
+guard reads that account's token and blocks against the right subscription. With
+a relocated config dir the macOS Keychain is skipped on purpose: that item
+belongs to the default login.
+
+**Only one of them can run as the background service.** The launchd label,
+systemd unit and Scheduled Task name are fixed, so the second `login` rewrites
+the first one's service definition rather than adding a second. Run the extra
+collector yourself with the same env — `... usagefleet watch`, under your own
+unit or terminal — and keep `login` for the account you want supervised.
 
 ## Background service
 

package/dist/claude-limits.js

@@ -3,13 +3,7 @@ export function parsePct(v) {
     if (v == null || v === '') {
         return null;
     }
-    const n = Number(v);
-    if (!Number.isFinite(n)) {
-        return null;
-    }
-    // Header is a percent (e.g. "37"); guard the 0–1 fraction form too.
-    const pct = n > 0 && n <= 1 ? n * 100 : n;
-    return Math.min(100, Math.max(0, Math.round(pct)));
+    return clampPct(Number(v));
 }
 export function parseReset(v) {
     if (!v) {
@@ -53,12 +47,12 @@ export function parseLimitsHeaders(source, get, names = []) {
 }
 const OAUTH_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 /**
- * Per-model limits for subscription logins. The Messages ping only returns the
- * account-wide 5h/7d headers; the per-model caps Claude's own UI shows (e.g.
- * "Fable · 24% used") come from the OAuth usage endpoint Claude Code queries
- * for /usage. Undocumented — parse defensively and return [] on any surprise.
+ * The OAuth usage endpoint Claude Code queries for /usage — the source of both
+ * the per-model caps its UI shows ("Fable · 24% used") and the account-wide
+ * numbers we trust over the response headers. Undocumented — parse defensively
+ * and return null on any surprise.
  */
-async function fetchOauthModelLimits(token) {
+async function fetchOauthUsage(token) {
     const res = await fetch(OAUTH_USAGE_URL, {
         headers: {
             'anthropic-beta': 'oauth-2025-04-20',
@@ -68,18 +62,57 @@ async function fetchOauthModelLimits(token) {
         signal: AbortSignal.timeout(15_000),
     });
     if (!res.ok) {
-        return [];
+        return null;
     }
     const body = await res.json().catch(() => null);
     if (process.env.USAGEFLEET_DEBUG_HEADERS) {
         console.error(`[debug] oauth/usage: ${JSON.stringify(body)}`);
     }
-    return parseOauthUsage(body);
+    return body;
 }
-/** oauth/usage values are already 0–100 percentages (unlike the 0–1 header
- *  fractions) — clamp without the fraction heuristic so 1% never reads as 100%. */
+/**
+ * Account-wide 5h/7d numbers from an oauth/usage payload: percentages
+ * (`{utilization: 14}`), exactly what Claude's /usage screen shows.
+ *
+ * These beat the `-utilization` response headers, which now carry a 0–1
+ * fraction (`0.13` for 13% used). Missing fields stay null so the header
+ * values survive.
+ */
+export function parseOauthAccount(body) {
+    const root = (typeof body === 'object' && body !== null ? body : {});
+    const window = (key) => {
+        const raw = root[key];
+        const entry = (typeof raw === 'object' && raw !== null ? raw : {});
+        return {
+            pct: typeof entry.utilization === 'number' ? clampPct(entry.utilization) : null,
+            resetsAt: typeof entry.resets_at === 'string' ? parseReset(entry.resets_at) : null,
+        };
+    };
+    const five = window('five_hour');
+    const seven = window('seven_day');
+    return {
+        fiveHourPct: five.pct,
+        fiveHourResetsAt: five.resetsAt,
+        sevenDayPct: seven.pct,
+        sevenDayResetsAt: seven.resetsAt,
+    };
+}
+/** Both sources report 0–100 percentages: the `-utilization` headers ("37") and
+ *  oauth/usage's `utilization`/`percent` fields. Clamping is all they need — a
+ *  0–1 "fraction form" heuristic would read a real 1% as 100%, which reaches the
+ *  headline number, the critical notification and guard's prompt block.
+ *
+ *  One decimal is kept (not rounded to whole): the server multiplies the group
+ *  split by the group count, so integer quantization would amplify to whole
+ *  points on the dashboard.
+ *
+ *  Non-finite in, null out: `Infinity` (a JSON `1e999`, or a junk header) would
+ *  otherwise clamp to a perfectly plausible 100 and block every prompt. */
 function clampPct(n) {
-    return Math.min(100, Math.max(0, Math.round(n)));
+    if (!Number.isFinite(n)) {
+        return null;
+    }
+    return Math.min(100, Math.max(0, Math.round(n * 10) / 10));
 }
 /** Normalize a scope's model name to a header-safe key ("Fable" → "fable"). */
 function modelKeyOf(name) {
@@ -151,12 +184,38 @@ export function parseOauthUsage(body) {
     }
     return out;
 }
+/** Assemble a full LimitsReport from an oauth/usage payload, or null when the
+ *  payload carries no account-wide percentage (endpoint down, shape changed) —
+ *  the caller then falls back to the header ping. */
+export function oauthLimitsReport(body) {
+    const account = parseOauthAccount(body);
+    if (account.fiveHourPct == null && account.sevenDayPct == null) {
+        return null;
+    }
+    return { ...account, modelLimits: parseOauthUsage(body), source: 'sub' };
+}
 /**
- * Read the account's real rate-limit utilization. Sends a 1-token ping to the
- * Messages API; Anthropic returns the unified 5h/7d utilization in response
- * headers (same approach as Claude-Usage-Tracker's OAuth path).
+ * Read the account's real rate-limit utilization.
+ *
+ * Subscription logins ask the free OAuth usage endpoint first — it returns the
+ * exact numbers Claude's own /usage screen shows (account-wide AND per-model)
+ * and costs no tokens, so it can be polled often. Only when it yields nothing
+ * (or for API keys, which can't call it) does this fall back to a 1-token ping
+ * to the Messages API, whose response headers carry the unified utilization
+ * (same approach as Claude-Usage-Tracker's OAuth path).
  */
 export async function fetchLimits(creds) {
+    if (creds.source === 'sub') {
+        try {
+            const report = oauthLimitsReport(await fetchOauthUsage(creds.token));
+            if (report) {
+                return report;
+            }
+        }
+        catch {
+            /* fall through to the header ping */
+        }
+    }
     const headers = {
         'anthropic-version': '2023-06-01',
         'content-type': 'application/json',
@@ -202,16 +261,5 @@ export async function fetchLimits(creds) {
     if (!res.ok && !gotHeaders) {
         throw new Error(`limits unavailable: HTTP ${res.status} with no rate-limit headers`);
     }
-    // Subscription logins: merge in the per-model caps from the OAuth usage
-    // endpoint (the ping headers never include them). Best-effort — keep the
-    // header-derived report on any failure.
-    if (creds.source === 'sub' && report.modelLimits.length === 0) {
-        try {
-            report.modelLimits = await fetchOauthModelLimits(creds.token);
-        }
-        catch {
-            /* endpoint unavailable — report account-wide limits only */
-        }
-    }
     return report;
 }

package/dist/guard.js

@@ -50,7 +50,10 @@ export async function runGuard() {
     catch {
         return 0; // offline / timeout / bad JSON — fail open
     }
-    const msg = blockMessage(view);
+    // A 200 whose body is literally `null` has to fail open like every other
+    // unexpected shape. Reading `.blocked` off it here would throw past the
+    // try above and out of runGuard, which is the one thing this must never do.
+    const msg = blockMessage(view ?? {});
     if (!msg) {
         return 0;
     }

package/dist/hook.js

@@ -9,9 +9,22 @@ const HOOK_TIMEOUT_S = 10;
 /** Recognises a guard hook we installed (at any binary path, from any version)
  *  so install is idempotent and uninstall is precise. */
 const GUARD_COMMAND = /usagefleet.*\bguard\b/;
-/** `/path/to/usagefleet guard`, quoted for the shell Claude Code runs it in. */
-export function guardCommand(program) {
-    return program.map(p => (p.includes(' ') ? `"${p}"` : p)).join(' ');
+/** `/path/to/usagefleet guard`, quoted for the shell Claude Code runs it in.
+ *  Carries USAGEFLEET_CONFIG through when set: the documented two-subscription
+ *  setup (apps/cli/README.md) gives each account its own store *and* its own
+ *  Claude settings.json, so without it both hooks would read the default config
+ *  and block against the wrong account. `platform` is a parameter so the two
+ *  shells can be tested; cmd.exe has no inline `VAR=value cmd` form, and the
+ *  POSIX prefix there would be read as a program name and never launch. */
+export function guardCommand(program, configPath, platform = process.platform) {
+    const quote = (p) => (p.includes(' ') ? `"${p}"` : p);
+    const command = program.map(quote).join(' ');
+    if (!configPath) {
+        return command;
+    }
+    return platform === 'win32'
+        ? `set "USAGEFLEET_CONFIG=${configPath}" && ${command}`
+        : `USAGEFLEET_CONFIG=${quote(configPath)} ${command}`;
 }
 /** Drop every guard hook we ever installed, leaving the rest of the file alone. */
 export function withoutGuardHook(settings) {
@@ -96,7 +109,7 @@ export function installPromptHook(program) {
     if (process.env.USAGEFLEET_HOOK === '0') {
         return;
     }
-    const command = guardCommand(program);
+    const command = guardCommand(program, process.env.USAGEFLEET_CONFIG);
     editSettings(s => withGuardHook(s, command), path => console.log(step('hook', `prompt guard · ${tilde(path)}`)));
 }
 export function uninstallPromptHook() {

package/dist/index.js

@@ -70,11 +70,14 @@ async function cmdWatch() {
     const cfg = loadConfig();
     const raw = Number(flag('interval') ?? process.env.USAGEFLEET_INTERVAL ?? 15);
     const interval = Math.max(1, Number.isFinite(raw) && raw > 0 ? raw : 15) * 1000;
-    // The limits ping hits the real Messages API (1 billable token) — don't run it
-    // every usage-scan tick. Report at most once per USAGEFLEET_LIMITS_INTERVAL
-    // seconds (default 300), decoupled from the much faster usage poll.
-    const rawLimits = Number(process.env.USAGEFLEET_LIMITS_INTERVAL ?? 300);
-    const limitsInterval = Math.max(interval / 1000, Number.isFinite(rawLimits) && rawLimits > 0 ? rawLimits : 300) * 1000;
+    // Limits reporting is decoupled from the much faster usage poll. Default
+    // interval depends on how the reading is fetched: subscription logins use the
+    // free oauth/usage endpoint (60s keeps the dashboard split fresh at zero token
+    // cost), API keys pay a 1-token Messages ping per reading (300s). An explicit
+    // USAGEFLEET_LIMITS_INTERVAL overrides both.
+    const rawLimits = Number(process.env.USAGEFLEET_LIMITS_INTERVAL);
+    const explicitLimits = Number.isFinite(rawLimits) && rawLimits > 0 ? rawLimits * 1000 : null;
+    let limitsInterval = explicitLimits ?? 60_000;
     let lastLimitsAt = 0;
     // Self-update: once at startup, then every USAGEFLEET_UPDATE_INTERVAL seconds
     // (default 6h — a release lands on a device the same day, not the next).
@@ -112,6 +115,9 @@ async function cmdWatch() {
                 if (limits) {
                     line(note, limitsSummary(limits));
                 }
+                if (explicitLimits === null) {
+                    limitsInterval = limits?.source === 'api' ? 300_000 : 60_000;
+                }
             }
         }
         catch (error) {
@@ -248,7 +254,7 @@ function cmdConfig() {
         ['USAGEFLEET_DESKTOP', 'override the Claude Desktop dir ("off" disables)'],
         ['USAGEFLEET_PI', 'override pi session dirs, comma-separated'],
         ['USAGEFLEET_INTERVAL', 'watch interval seconds (default 15)'],
-        ['USAGEFLEET_LIMITS_INTERVAL', 'seconds between limits pings (default 300)'],
+        ['USAGEFLEET_LIMITS_INTERVAL', 'seconds between limits reports (default 60; 300 on API keys)'],
         ['USAGEFLEET_BATCH', 'records per upload (default 100, max 1000)'],
         ['USAGEFLEET_NOTIFY', 'desktop notifications (0 disables)'],
         ['USAGEFLEET_NOTIFY_THRESHOLDS', 'comma list of % alerts (default 80,95)'],
@@ -289,11 +295,15 @@ async function main() {
     // Log-and-continue for the long-running watch daemon: a stray rejection must
     // not silently kill the background service. One-shot commands still set a
     // non-zero exit via their own error paths.
+    //
+    // stderr, not `line()`: `usagefleet guard` runs as a UserPromptSubmit hook and
+    // Claude Code injects a hook's stdout into the model's context, so a crash
+    // notice on stdout would end up in the conversation.
     process.on('unhandledRejection', reason => {
-        line(yellow('!'), `unhandled rejection ${dim(String(reason))}`);
+        console.error(`${yellow('!')} unhandled rejection ${dim(String(reason))}`);
     });
     process.on('uncaughtException', err => {
-        line(yellow('!'), `uncaught exception ${dim(err.message)}`);
+        console.error(`${yellow('!')} uncaught exception ${dim(err.message)}`);
     });
     const cmd = process.argv[2] ?? 'help';
     switch (cmd) {

package/dist/notifier.js

@@ -88,13 +88,16 @@ export function maybeNotify(report, cfg = loadNotifyConfig(), log = () => {
         const state = readStore(path).notify;
         const five = evaluateWindow(state.fiveHour, report.fiveHourPct, report.fiveHourResetsAt, cfg.thresholds);
         const seven = evaluateWindow(state.sevenDay, report.sevenDayPct, report.sevenDayResetsAt, cfg.thresholds);
+        // Readings can carry a decimal; notification copy rounds to whole.
+        const fivePct = Math.round(report.fiveHourPct ?? 0);
+        const sevenPct = Math.round(report.sevenDayPct ?? 0);
         if (five.fire != null) {
-            sendNotification('Claude usage · 5-hour limit', `${report.fiveHourPct}% of your 5-hour limit used${resetSuffix(report.fiveHourResetsAt)}.`, { urgency: urgencyFor(five.fire) });
-            log('ok', `notified · 5h at ${report.fiveHourPct}% · crossed ${five.fire}%`);
+            sendNotification('Claude usage · 5-hour limit', `${fivePct}% of your 5-hour limit used${resetSuffix(report.fiveHourResetsAt)}.`, { urgency: urgencyFor(five.fire) });
+            log('ok', `notified · 5h at ${fivePct}% · crossed ${five.fire}%`);
         }
         if (seven.fire != null) {
-            sendNotification('Claude usage · weekly limit', `${report.sevenDayPct}% of your weekly limit used${resetSuffix(report.sevenDayResetsAt)}.`, { urgency: urgencyFor(seven.fire) });
-            log('ok', `notified · weekly at ${report.sevenDayPct}% · crossed ${seven.fire}%`);
+            sendNotification('Claude usage · weekly limit', `${sevenPct}% of your weekly limit used${resetSuffix(report.sevenDayResetsAt)}.`, { urgency: urgencyFor(seven.fire) });
+            log('ok', `notified · weekly at ${sevenPct}% · crossed ${seven.fire}%`);
         }
         updateStore(path, store => {
             store.notify = { fiveHour: five.next, sevenDay: seven.next };

package/dist/os.js

@@ -10,7 +10,8 @@ export function detectOs() {
             return 'linux';
         }
         default: {
-            return process.platform;
+            // freebsd/sunos/android: still a usable collector, just an unlabelled box.
+            return 'other';
         }
     }
 }

package/dist/parser.js

@@ -9,22 +9,24 @@ function validTimestamp(v) {
     }
     return new Date().toISOString();
 }
+/** Cache-write tokens, with the per-TTL breakdown when the log carries it.
+ *  5m and 1h writes are priced differently (1.25× vs 2× input), so the server
+ *  wants the split — null means "the log predates the breakdown", not zero. */
 function cacheCreation(u) {
-    if (typeof u.cache_creation_input_tokens === 'number') {
-        return u.cache_creation_input_tokens;
-    }
     const c = u.cache_creation;
-    if (c) {
-        return (c.ephemeral_5m_input_tokens ?? 0) + (c.ephemeral_1h_input_tokens ?? 0);
-    }
-    return 0;
+    const five = typeof c?.ephemeral_5m_input_tokens === 'number' ? c.ephemeral_5m_input_tokens : null;
+    const oneHour = typeof c?.ephemeral_1h_input_tokens === 'number' ? c.ephemeral_1h_input_tokens : null;
+    const total = typeof u.cache_creation_input_tokens === 'number' ? u.cache_creation_input_tokens : (five ?? 0) + (oneHour ?? 0);
+    return { five, oneHour, total };
 }
 /** pi agent session line: `{type:"message", id, timestamp, message:{role:"assistant",
  *  provider, model, responseId, usage:{input, output, cacheRead, cacheWrite}}}`.
  *  Only provider "anthropic" hits the user's Claude account — other providers
  *  (openai-codex, openrouter, …) are skipped. `output` already includes reasoning
- *  tokens (totalTokens = input + output + cacheRead + cacheWrite). */
-function parsePiLine(o) {
+ *  tokens (totalTokens = input + output + cacheRead + cacheWrite).
+ *  The line carries no working directory; `sessionCwd` comes from the file's
+ *  session header (see piSessionCwd). */
+function parsePiLine(o, sessionCwd) {
     if (o.type !== 'message') {
         return null;
     }
@@ -45,9 +47,13 @@ function parsePiLine(o) {
         return null;
     }
     return {
+        // pi's usage line does not say which TTL the cache write used — leave the
+        // breakdown unknown so the server prices it by the user's TTL setting.
+        cacheCreation1h: null,
+        cacheCreation5m: null,
         cacheCreationTokens: u.cacheWrite ?? 0,
         cacheReadTokens: u.cacheRead ?? 0,
-        cwd: null,
+        cwd: sessionCwd,
         gitBranch: null,
         inputTokens: u.input ?? 0,
         messageId: rid,
@@ -68,8 +74,9 @@ function parsePiLine(o) {
  * `uuid` is the per-line idempotency key the server dedups on. `source` tags which
  * app the file came from (the line itself carries no app identifier) and selects
  * the format: `pi` files use pi's own schema, everything else Claude Code's.
+ * `sessionCwd` is the file-level working directory, used only by `pi`.
  */
-export function parseLine(line, source = 'cli') {
+export function parseLine(line, source = 'cli', sessionCwd = null) {
     const trimmed = line.trim();
     if (!trimmed) {
         return null;
@@ -92,7 +99,7 @@ export function parseLine(line, source = 'cli') {
     }
     const o = parsed;
     if (source === 'pi') {
-        return parsePiLine(o);
+        return parsePiLine(o, sessionCwd);
     }
     if (o.type !== 'assistant') {
         return null;
@@ -106,8 +113,11 @@ export function parseLine(line, source = 'cli') {
         return null;
     }
     const u = message.usage;
+    const cache = cacheCreation(u);
     return {
-        cacheCreationTokens: cacheCreation(u),
+        cacheCreation1h: cache.oneHour,
+        cacheCreation5m: cache.five,
+        cacheCreationTokens: cache.total,
         cacheReadTokens: u.cache_read_input_tokens ?? 0,
         cwd: str(o.cwd),
         gitBranch: str(o.gitBranch),

package/dist/release.js

@@ -1,2 +1,2 @@
 // Generated by .github/workflows/release.yml.
-export const RELEASE_VERSION = "1.2.78";
+export const RELEASE_VERSION = "1.2.80";

package/dist/service.js

@@ -309,27 +309,36 @@ ${envXml}
         catch {
             /* not loaded yet — fine */
         }
+        let loaded = false;
         try {
             execFileSync('launchctl', ['bootstrap', domain, path], {
                 stdio: 'inherit',
             });
+            loaded = true;
         }
         catch {
             try {
                 execFileSync('launchctl', ['load', path], { stdio: 'inherit' });
+                loaded = true;
             }
             catch {
                 /* report below; user can load manually */
             }
         }
-        // Force a (re)start so an update takes effect immediately, not on next respawn.
-        try {
-            execFileSync('launchctl', ['kickstart', '-k', `${domain}/${LABEL}`], {
-                stdio: 'ignore',
-            });
-        }
-        catch {
-            /* best-effort */
+        // Only when the (re)load failed — i.e. the old job is still resident, so this
+        // is the one thing that can swap it. On a job launchd just started via
+        // RunAtLoad, `kickstart -k` kills that instance and the respawn waits out
+        // ThrottleInterval: a guaranteed 30s hole where `status` right after an
+        // update reads "stopped".
+        if (!loaded) {
+            try {
+                execFileSync('launchctl', ['kickstart', '-k', `${domain}/${LABEL}`], {
+                    stdio: 'ignore',
+                });
+            }
+            catch {
+                /* best-effort */
+            }
         }
         console.log(step('service', 'launchd · starts at login'));
         console.log(row('logs', tilde(macLogDir())));

package/dist/tailer.js

@@ -3,6 +3,27 @@ import { parseLine } from './parser.js';
 import { dim, line, tilde, yellow } from './ui.js';
 /** Max bytes read from a single file per cycle (bounds memory on huge backlogs). */
 const MAX_READ = 16 * 1024 * 1024;
+/**
+ * The working directory of a pi session, read from the file's first line
+ * (`{"type":"session",…,"cwd":"/path"}`). pi's message lines carry no cwd, and
+ * tailing usually resumes past the header, so it is re-read per cycle rather
+ * than remembered. The session dir name encodes the same path but lossily
+ * (`/Developer/claude-track` and `/Developer/claude/track` collide), so the
+ * header is the only exact source.
+ */
+function piSessionCwd(fd) {
+    const head = Buffer.alloc(4096);
+    const read = readSync(fd, head, 0, head.length, 0);
+    const nl = head.indexOf(0x0a);
+    try {
+        const o = JSON.parse(head.subarray(0, nl === -1 ? read : nl).toString('utf-8'));
+        const cwd = o?.cwd;
+        return typeof cwd === 'string' && cwd.length > 0 ? cwd : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Read new, newline-terminated lines from `filePath` starting at the previously
  * stored offset. Handles rotation/truncation (inode change or size < offset →
@@ -27,8 +48,12 @@ export function tailFile(filePath, prev, source = 'cli') {
     const length = Math.min(st.size - start, MAX_READ);
     const buf = Buffer.alloc(length);
     const fd = openSync(filePath, 'r');
+    let sessionCwd = null;
     try {
         readSync(fd, buf, 0, length, start);
+        if (source === 'pi') {
+            sessionCwd = piSessionCwd(fd);
+        }
     }
     finally {
         closeSync(fd);
@@ -52,7 +77,7 @@ export function tailFile(filePath, prev, source = 'cli') {
     const text = consumed.toString('utf-8');
     const records = [];
     for (const line of text.split('\n')) {
-        const rec = parseLine(line, source);
+        const rec = parseLine(line, source, sessionCwd);
         if (rec) {
             records.push(rec);
         }

package/dist/ui.js

@@ -86,9 +86,10 @@ export function line(glyph, text) {
 }
 /** Neutral stream glyph, for messages that are neither good nor bad news. */
 export const note = dim('·');
-/** Percentage as a fixed-width string, so successive log lines line up. */
+/** Percentage as a fixed-width string, so successive log lines line up.
+ *  Readings can carry a decimal; display rounds to whole. */
 export function pct(value) {
-    return `${value ?? '?'}%`.padStart(4);
+    return `${value === null ? '?' : Math.round(value)}%`.padStart(4);
 }
 /** Usage bar, coloured by how close the window is to its limit.
  *  Unknown usage renders as an empty bar rather than a missing column. */

package/dist/update.js

@@ -19,14 +19,34 @@ function npmCommand() {
     const sibling = join(dirname(process.execPath), process.platform === 'win32' ? 'npm.cmd' : 'npm');
     return existsSync(sibling) ? sibling : 'npm';
 }
-/** Exit code of a finished child, or null when it could not be started. */
+/** An `npm install` that never returns would hang the watch loop forever, since
+ *  the update check is awaited inline before the next tick is scheduled: the
+ *  daemon would still be "running" while collecting nothing, with an empty log.
+ *  Generous enough for a slow registry on a cold cache. */
+const RUN_TIMEOUT_MS = 10 * 60_000;
+/** Exit code of a finished child, or null when it could not be started, was
+ *  killed for exceeding RUN_TIMEOUT_MS, or died on a signal. */
 function run(cmd, args) {
     return new Promise(resolve => {
         // shell on Windows: node refuses to spawn a .cmd directly since the 2024
         // argument-injection fix. Every argument here is a literal or VERSION-checked.
         const child = spawn(cmd, args, { shell: process.platform === 'win32', stdio: 'ignore' });
-        child.on('error', () => resolve(null));
-        child.on('close', code => resolve(code));
+        const timer = setTimeout(() => child.kill(), RUN_TIMEOUT_MS);
+        // Node emits 'close' after 'error' for a failed spawn, so both handlers can
+        // run; `settled` makes the first one win. oxlint's promise rule sees the two
+        // registrations and can't see the guard between them.
+        let settled = false;
+        const finish = (code) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            // oxlint-disable-next-line promise/no-multiple-resolved
+            resolve(code);
+        };
+        child.on('error', () => finish(null));
+        child.on('close', code => finish(code));
     });
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@usagefleet/cli",
-	"version": "1.2.78",
+	"version": "1.2.80",
 	"description": "Tails Claude Code, Claude Desktop, and pi agent JSONL logs and reports token usage to a UsageFleet server.",
 	"keywords": [
 		"claude",